Urgent.News

What's breaking now, across thousands of outlets.

Tech

My MCP Tool Fetches Before It Writes and Logs Every Change. It Never Checked Whether There Was Anything to Change.

Two fixes ago, update_article — one of the tools in this repo's MCP server — got hardened twice. The first time, because it took a bare integer article_id , PUT whatever fields you gave it straight to the DEV.to API, and if the id was wrong it would silently overwrite a live published post with nothing left behind to prove it happened. That fix added a fetch-before-write step and a JSONL audit…

The MCP tool, part of a repository's MCP server, experienced two bug fixes. Initially, it sent empty data to the DEV.to API when provided with bare integers for article_id, overwriting live posts without leaving any trace. The second fix recorded a hardcoded diff regardless of actual changes, causing the log to show "nothing changed" even when the body_markdown was edited.

Both fixes failed to verify if any changes were made at all. The function signature, def update_article(article_id:int, title:str=None, body_markdown:str=None, published:bool=None) -> dict, defaults parameters to None, allowing updates to just the title without sending the entire body. However, this design flaw meant the function wouldn't short-circuit if all parameters were None.

Calling update_article(article_id=123) would fetch the current article, PUT an empty {article:{}} to the live post, and log the result as if meaningful changes occurred. This identical issue could arise from passing incorrect argument names or leaving the function to handle no-op scenarios inadvertently. The solution was to implement a check before making any changes, ensuring that at least one of title, body_markdown, or published is provided.

While the server-side handling of an empty article object was unclear, the client-side bug was confirmed as reproducible and independent of server error handling.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Day 24 of 100

Today I learnt all about files, paths and directories. I learnt what a relative and absolute file path is as well as how to use both in Pycharm alongside reading and writing files.

  • On the 24th day of the 100-day journey, the author discovered file path intricacies.
  • The author practiced using both relative and absolute file paths in Pycharm.
  • The author enhanced a Snake game with a high score feature that persisted across game loads.

Why Low-Code Platforms Need a Plugin Mechanism

In the previous post about workflow engines, I ended with a distinction: Workflows determine how business moves forward. Automation and plugins determine how the platform extends those actions beyond…

More from Saturday 8 August →